Ubuntu update for vim
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 12 |
| CVE-ID | CVE-2023-3896 CVE-2023-4733 CVE-2023-4734 CVE-2023-4735 CVE-2023-4738 CVE-2023-4750 CVE-2023-4751 CVE-2023-4752 CVE-2023-4781 CVE-2023-5344 CVE-2023-5441 CVE-2023-5535 |
| CWE-ID | CWE-369 CWE-416 CWE-190 CWE-125 CWE-119 CWE-122 CWE-476 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Ubuntu Operating systems & Components / Operating system vim-gtk (Ubuntu package) Operating systems & Components / Operating system package or component xxd (Ubuntu package) Operating systems & Components / Operating system package or component vim-tiny (Ubuntu package) Operating systems & Components / Operating system package or component vim-nox (Ubuntu package) Operating systems & Components / Operating system package or component vim-gtk3 (Ubuntu package) Operating systems & Components / Operating system package or component vim-athena (Ubuntu package) Operating systems & Components / Operating system package or component vim (Ubuntu package) Operating systems & Components / Operating system package or component |
| Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains information about 12 vulnerabilities.
1) Division by zero
EUVDB-ID: #VU80201
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-3896
CWE-ID:
CWE-369 - Divide By Zero
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to crash the application.
The vulnerability exists due to division by zero error within the scroll_cursor_bot() function. A remote attacker can trick the victim to open a specially crafted file and crash the application.
Update the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:16.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:18.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:23.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu:23.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Use-after-free
EUVDB-ID: #VU80502
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-4733
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to crash the application.
The vulnerability exists due to a use-after-free error within the do_ecmd() function in ex_cmds.c. A remote attacker can trick the victim to open a specially crafted file and crash the application.
Update the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Integer overflow
EUVDB-ID: #VU81485
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-4734
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within the f_fullcommand() function in ex_docmd.c. A remote attacker can trick the victim to open a specially crafted file, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Out-of-bounds read
EUVDB-ID: #VU80503
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-4735
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the do_addsub() function in ops.c. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Buffer overflow
EUVDB-ID: #VU80504
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-4738
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to crash the application.
The vulnerability exists due to a boundary error within the vim_regsub_both() function in src/regexp.c. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and crash the application.
Update the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Use-after-free
EUVDB-ID: #VU80505
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-4750
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to crash the application.
The vulnerability exists due to a use-after-free error within the is_qf_win() function in quickfix.c. A remote attacker can trick the victim to open a specially crafted file and crash the application.
Update the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Heap-based buffer overflow
EUVDB-ID: #VU81488
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-4751
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the utfc_ptr2len() function in mbyte.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Use-after-free
EUVDB-ID: #VU80506
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-4752
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to crash the application.
The vulnerability exists due to a use-after-free error within the ins_compl_get_exp() function in insexpand.c. A remote attacker can trick the victim to open a specially crafted file and crash the application.
Update the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Heap-based buffer overflow
EUVDB-ID: #VU80474
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-4781
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to crash the application.
The vulnerability exists due to a boundary error within the vim_regsub_both() function. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and crash the application.
Update the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Heap-based buffer overflow
EUVDB-ID: #VU81486
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-5344
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the trunc_string() function in message.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) NULL pointer dereference
EUVDB-ID: #VU82311
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-5441
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in src/gui.c. A remote attacker can trick the victim to open a specially crafted file and crash the application.
Update the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Use-after-free
EUVDB-ID: #VU82310
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-5535
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the editing_arg_idx() function. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 23.10
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
xxd (Ubuntu package): before Ubuntu Pro
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:xxd_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6452-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
